Report by Zero Networks
2026 Lateral Movement Exposure Report
Key Findings
East–West internal traffic represents more than 70% of a company’s communications and remains unprotected.
78% of enterprise servers are reachable over SMB or WinRM, administrative protocols commonly exploited for ransomware spread and lateral movement.
87% of enterprise servers accept inbound RDP or SSH connections from broad internal sources, giving attackers wide access pathways once inside the network.
12% of organizations maintain direct user-to-server administrative pathways, meaning a single compromised employee device can provide immediate access to high-value systems.
Roughly 80% of enterprises have deployed internal AI agents while two-thirds lack governance policies for those agents.
80% of enterprise servers are reachable from anywhere inside the network, creating greenfield conditions for ransomware, operational disruption, and full-environment compromise.
43% of internal authentication traffic still relies on NTLM, a legacy protocol frequently abused for credential replay and privilege escalation attacks.